Rewterz Threat Alert – Team9 Backdoor

Severity

Medium

Analysis Summary

Researchers have published an analysis of the Team9 (aka Bazar) backdoor and loader. The infection begins with a loader, two variants of which were analyzed previously. The earlier variant downloads the backdoor using Windows BITS, which is no longer the case. Additionally the strings are not encrypted and the Windows API functions are not loaded dynamically. After ensuring no existing infections are present, the loader establishes persistence using a Registry Run key. It then covers its tracks by deleting itself via a batch file. The victim host’s architecture is identified and the associated backdoor component is downloaded from one of two hard-coded C2 servers. If the downloaded version is 32-bit, it is injected into calc.exe using process hollowing. Otherwise it is written to disk and executed. The newer variant of the loader operates similarly but adds in string encryption and dynamic loading of the Windows API functions. Process injection now occurs with both architectures; svchost, explorer, and cmd are the target processes. Additional persistence mechanisms are implemented including scheduled tasks, Winlogon hijacking, and Startup folder shortcuts. The analysis of the downloaded backdoors shows C2 communication occurs over ports 80 and 443. It is capable of receiving commands that allow for system information collection, downloading and execution of files and scripts, file exfiltration, and more.

Impact

• Data exfiltration
• Information theft
• Exposure of sensitive data

Indicators of Compromise

SHA-256

• 4F258184D5462F64C3A752EC25FB5C193352C34206022C0755E48774592B7707
• B10DCEC77E00B1F9B1F2E8E327A536987CA84BCB6B0C7327C292F87ED603837D
• 363B6E0BC8873A6A522FE9485C7D8B4CBCFFA1DA61787930341F94557487C5A8
• F4A5FE23E21B6B7D63FA2D2C96A4BC4A34B40FD40A921B237A50A5976FE16001
• A0D0CFA8BF0BC5B8F769D8B64EAB22D308B108DD8A4D59872946D69C3F8C58A5
• 059519E03772D6EEEA9498625AE8B8B7CF2F01FC8179CA5D33D6BCF29D07C9F4
• 0F94B77892F22D0A0E7095B985F30B5EDBE17AB5B8D41F798EF0C708709636F4
• 2F0F0956628D7787C62F892E1BD9EDDA8B4C478CF8F1E65851052C7AD493DC28
• 37D713860D529CBE4EAB958419FFD7EBB3DC53BB6909F8BD360ADAA84700FAF2
• 3400A7DF9EC3DC8283D5AC7ACCB6935691E93FEDA066CC46C6C04D67F7F87B2B
• 5974D938BC3BBFC69F68C979A6DC9C412970FC527500735385C33377AB30373A
• C55F8979995DF82555D66F6B197B0FBCB8FE30B431FF9760DEAE6927A584B9E3

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.